Re: [PATCH 11/19] drm/amd/display/amdgpu_dm: Finish DC accessor migration for non-test code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] drm/amd/display: uninitialized stack memory read in
  get_conv_frl_bw() [1]
--

commit 7d52238d02a453de3c024a3c4edfc5cc756f0bed
Author: Dave Airlie <airlied@redhat.com>

drm/amd/display/amdgpu_dm: Finish DC accessor migration for non-test code

This commit converts the remaining struct dc member dereferences in
amdgpu_dm production code to use accessor functions and moves the
PERFORMANCE_TRACE_START and PERFORMANCE_TRACE_END macros into
dc/dm_services.h.

> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
> index a3877ef767eca..2cbe08298706a 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
> @@ -1239,7 +1239,7 @@ STATIC_IFN_KUNIT bool get_conv_frl_bw(struct amdgpu_dm_connector *aconnector,
>  	unsigned int dsc_max_sink_bw_in_kbps = 0;
>  
>  	if (aconnector->dc_sink &&
> -	    aconnector->dc_link->dc->caps.dp_hdmi21_pcon_support &&
> +	    dc_get_caps(aconnector->dc_link->dc)->dp_hdmi21_pcon_support &&
>  	    aconnector->mst_downstream_port_caps.bytes.byte0.bits.DWN_STRM_PORTX_TYPE == DOWN_STREAM_DETAILED_HDMI) {
>  		max_conv_bw_in_kbps = dc_link_bw_kbps_from_raw_frl_link_rate_data(
>  				aconnector->dc_link->dc,

[Severity: High]
This problem wasn't introduced by this patch, but can get_conv_frl_bw()
read uninitialized stack memory from *bw_in_kbps [1]?

compute_mst_dsc_configs_for_link() declares frl_conv_bw_in_kbps and
frl_conv_dsc_bw_in_kbps on the stack without initializing them and passes
them to get_conv_frl_bw():

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:get_conv_frl_bw() {
	if (aconnector->dc_sink &&
	    dc_get_caps(aconnector->dc_link->dc)->dp_hdmi21_pcon_support &&
	    aconnector->mst_downstream_port_caps.bytes.byte0.bits.DWN_STRM_PORTX_TYPE == DOWN_STREAM_DETAILED_HDMI) {
		...
		if (aconnector->dc_sink->edid_caps.max_frl_rate && max_conv_bw_in_kbps) {
			...
			*bw_in_kbps = min(max_conv_bw_in_kbps, max_sink_bw_in_kbps);
			*dsc_bw_in_kbps = min(*bw_in_kbps, dsc_max_sink_bw_in_kbps);
		}
	}

	return *bw_in_kbps > 0; // Frl endpoint is detected
}

When the downstream port is not HDMI 2.1 PCON or max_frl_rate is 0,
neither output pointer is written before *bw_in_kbps > 0 is evaluated.
If stack contents make *bw_in_kbps non-zero, get_conv_frl_bw() returns
true and compute_mst_dsc_configs_for_link() passes the uninitialized
frl_conv_dsc_bw_in_kbps into build_frl_mst_dsc_params().

[1] https://sashiko.dev/#/bug/linux-04300f5e-3be1-4eaf-ab02-d1aa2df32bb9

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-amdgpu-dc-cleanup-v1-0-0fae41718ad2@redhat.com?part=11